T09 · Insecure Skill Coding Practices
- Location
scripts/script.sh:6- Finding
Plaintext Storage of Potentially Sensitive Data with Permissive Default Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/script.sh, lines 6-8, 30, and 53-55
Vulnerability Type: Insecure storage and insufficient filesystem permission hardening
Risk Level: MediumVulnerable Code
bash DATA_DIR="${LABOR_LAW_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/labor-law}" DB="$DATA_DIR/data.log" mkdir -p "$DATA_DIR"bash _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }bash cmd_add() { echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*" _log "add" "${1:-}" }Technical Analysis
The script persistently records arbitrary user-supplied entries in
data.logand command activity inhistory.log. These files are stored as unencrypted plaintext. The script creates the storage directory and files using the caller's ambientumask, without explicitly enforcing owner-only permissions.Under a commonly used
022umask, the directory can be created with mode0755and log files with mode0644. This may allow other local users to traverse the directory and read its files. Because the tool is presented for labor-law and employment-related use, stored entries may contain compensation details, employment disputes, contract information, or other personal data.The
LABOR_LAW_DIRandXDG_DATA_HOMEenvironment variables also control the storage location. Although this is documented functionality, the script does not validate whether the selected directory or destination files are symbolic links, privately owned, or otherwise safe for sensitive storage.Attack Path
- A user runs
labor-law addwith sensitive employment or personal information. scripts/script.shcreates the data directory usingmkdir -pwithout setting an explicit restrictive mode.- The shell creates
data.logandhistory.logthrough append redirection, inheriting permissions from the ambientumask. - On a shared system with a pe ...[truncated 1270 chars]
- A user runs
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive process umask before creating any storage:
bash umask 077 -
Create and verify an owner-only directory:
bash mkdir -p -m 700 -- "$DATA_DIR" chmod 700 -- "$DATA_DIR" -
Create log files with mode
0600before appending:bash install -m 600 /dev/null "$DB" install -m 600 /dev/null "$DATA_DIR/history.log"Existing regular files should be preserved rather than overwritten, while their ownership and permissions should still be validated.
-
Reject unsafe destinations. Before writing, verify that the directory is owned by the current user and that
data.logandhistory.logare regular files rather than symbolic links. Use canonical-path validation when acceptingLABOR_LAW_DIRorXDG_DATA_HOME. -
Avoid recording unnecessary user content in activity history. Document exactly what is retained and provide a command for securely clearing retained records.
-
Warn users that entries are stored locally in plaintext and should not include credentials, identity numbers, privileged legal documents, or unnecessary personal information. If highly sensitive records are an intended use case, use an authenticated encryption mechanism and a secure key-management design.
-